73 lines
2.9 KiB
Groovy
73 lines
2.9 KiB
Groovy
// Sirf signature ye batata hai ki "image hamne banayi". Provenance attestation
|
|
// ye batata hai ki "kaunse commit se, kis machine par, kab, kis pipeline se".
|
|
// Audit me yahi sabse pehle poochha jaata hai.
|
|
def call(Map info) {
|
|
withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
|
|
withEnv([
|
|
"P_REPO=${info.repo}", "P_COMMIT=${info.commit}",
|
|
"P_BUILD=${info.build}", "P_JOB=${info.job}", "P_BUILDER=${info.builder}"
|
|
]) {
|
|
sh '''
|
|
set +x
|
|
umask 077
|
|
WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT
|
|
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
|
|
python3 - "$WORK" <<'PY'
|
|
import json, sys, os
|
|
w = sys.argv[1]
|
|
d = json.load(open(w + '/c.json'))['data']['data']
|
|
for k, f in (('private_key', 'cosign.key'), ('password', 'pw')):
|
|
open(os.path.join(w, f), 'w').write(d[k])
|
|
PY
|
|
curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
|
|
python3 - "$WORK" "$REGISTRY" <<'PY'
|
|
import base64, json, os, sys
|
|
w, reg = sys.argv[1], sys.argv[2]
|
|
d = json.load(open(w + '/r.json'))['data']['data']
|
|
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
|
|
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
|
|
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
|
|
PY
|
|
|
|
# SLSA v0.2 predicate - kis source se kaise bani
|
|
python3 - "$WORK" <<'PY'
|
|
import json, os, sys, datetime
|
|
w = sys.argv[1]
|
|
pred = {
|
|
"builder": {"id": os.environ["P_BUILDER"]},
|
|
"buildType": "https://ns31240276.ip-51-195-4.eu/devops-platform/jenkins@v1",
|
|
"invocation": {
|
|
"configSource": {
|
|
"uri": os.environ["P_REPO"],
|
|
"digest": {"sha1": os.environ["P_COMMIT"]},
|
|
"entryPoint": os.environ["P_JOB"],
|
|
},
|
|
"environment": {"buildNumber": os.environ["P_BUILD"]},
|
|
},
|
|
"metadata": {
|
|
"buildInvocationId": os.environ["P_BUILD"],
|
|
"buildFinishedOn": datetime.datetime.now(datetime.timezone.utc)
|
|
.strftime("%Y-%m-%dT%H:%M:%SZ"),
|
|
"completeness": {"parameters": True, "environment": False, "materials": True},
|
|
"reproducible": False,
|
|
},
|
|
"materials": [{
|
|
"uri": os.environ["P_REPO"],
|
|
"digest": {"sha1": os.environ["P_COMMIT"]},
|
|
}],
|
|
}
|
|
open(w + '/predicate.json', 'w').write(json.dumps(pred, indent=2))
|
|
PY
|
|
|
|
COSIGN_PASSWORD=$(cat $WORK/pw) cosign attest \
|
|
--key $WORK/cosign.key --yes --tlog-upload=false \
|
|
--type slsaprovenance --predicate $WORK/predicate.json \
|
|
"$FULL_IMAGE"
|
|
rm -f ~/.docker/config.json
|
|
echo " provenance attach ho gaya: $FULL_IMAGE"
|
|
'''
|
|
}
|
|
}
|
|
}
|